Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-30 | 2 | Disclosure2 |
| 2026-02-08 | 1 | Patch1 |
| 2026-02-11 | 2 | Disclosure1Patch1 |
| 2026-02-20 | 1 | Disclosure1 |
| 2026-02-24 | 1 | Patch1 |
| 2026-02-27 | 1 | Patch1 |
| 2026-03-04 | 1 | Patch1 |
| 2026-06-27 | 1 | Disclosure1 |
libexpat 2.7.4 fixes 2 CVEs https://www.openwall.com/lists/oss-security/2026/01/31/1 CVE-2026-24515 NULL pointer dereference CVE-2026-25210 Integer overflow
Post summary
The post announces that libexpat version 2.7.4 includes a patch fixing CVE-2026-24515 (NULL pointer dereference) and CVE-2026-25210 (Integer overflow) with no evidence of active exploitation or PoC.
[492812194] Vulnerability: CVE-2026-25210 affecting GitOnBorg::chromium::chromium::src http://crbug.com/492812194
Post summary
The post announces CVE‑2026‑25210 affecting Chromium source and links to a Crbug issue, but provides no further technical detail, PoC, or exploit information.
Memory safety is non-negotiable for high-performance systems. 🧠 The bundled libexpat library is upgraded to 2.7.4. Fixes for CVE-2026-24515 and CVE-2026-25210 prevent memory amplification and crashes during XML parsing. A critical "use-after-free" bug in the ssl module has been neutralized. 🔒
Post summary
The update to libexpat 2.7.4 includes patches for CVE-2026-24515 and CVE-2026-25210, mitigating memory amplification and XML parsing crashes, while also neutralizing a critical use‑after‑free bug in the ssl module.
Urgent: #SUSE Linux Micro 6.1 patches Expat library with fixes for CVE-2026-24515 (NULL dereference) and CVE-2026-25210 (integer overflow). Read more: 👉 https://tinyurl.com/ya558teh #Security https://t.co/8Iy2xUVJbT
Post summary
The tweet announces that SUSE Linux Micro 6.1 has released patches addressing CVE-2026-24515 (NULL dereference) and CVE-2026-25210 (integer overflow).
🔍 Lambda Watchdog detected that CVE-2026-25210 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/425 #AWS #Lambda #Security #CVE #DevOps #SecOps
Post summary
AWS Lambda base images have been updated to remove CVE-2026-25210, indicating the vulnerability has been patched.
🚨 New MEDIUM CVE detected in AWS Lambda 🚨 CVE-2026-25210 impacts expat in 7 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/425 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
Post summary
The tweet announces a new Medium‑severity CVE (CVE‑2026‑25210) that affects expat in several AWS Lambda base images, with links for more details.
Expat XML parser flaws in Ubuntu 25.10, 22.04 LTS and older allow DoS or possible code execution via crafted XML, impacting xmltok (CVE-2025-59375, CVE-2026-24515, CVE-2026-25210). #Linux https://threatcluster.io/cluster/critical-expat-vulnerabilities-affect-multiple-ubuntu-releas-7b8a8fa0
Post summary
The tweet announces Expat XML parser vulnerabilities (CVE‑2025‑59375, CVE‑2026‑24515, CVE‑2026‑25210) affecting Ubuntu, noting DoS and potential code execution via crafted XML, without providing PoC, exploit, or patch details.
USN-8023-1: libxmltok flaws (CVE-2026-24515 & CVE-2026-25210) are now public. Key takeaway: CVE-2026-25210 = Integer Overflow → Heap Overflow → Potential RCE. ⚠️ Patches ONLY in #Ubuntu Pro/ESM repos. Read more: 👉 https://tinyurl.com/fd6dsmfu #Security https://t.co/JR4e8Mh9LR
Post summary
The Ubuntu Security Notice announces CVE-2026-25210 as a potential RCE via an integer overflow and indicates that patches are available only in Ubuntu Pro/ESM repositories.
CVE-2026-25210 Integer Overflow Vulnerability in Libexpat XML Parser Before 2.7.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25210
Post summary
The text announces an integer overflow vulnerability in libexpat versions prior to 2.7.4, but does not provide a PoC, exploit, or patch information.
CVE-2026-25210 In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer realloc… https://www.cve.org/CVERecord?id=CVE-2026-25210
Post summary
The statement reveals a buffer overflow risk in libexpat before version 2.7.4 due to a missing integer overflow check during tag buffer reallocation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | libexpat_project | libexpat | - | - | - |